The Infrastructure Bottleneck for Most Migrations
Public key infrastructure is the bottleneck for most enterprise PQC migrations. Post-quantum certificates are much larger than classical ones. The extra size affects certificate chains, validation, OCSP responses, TLS handshakes, and HSM storage. This 8-hour course covers PKI modernization in depth. Topics include dual-capability PKI design, certificate chain size, HSM inventory and firmware paths, trust anchor migration, and certificate lifecycle management during the transition.
Course Outline
Module 1 The Post-Quantum PKI Challenge
Why PKI is the infrastructure bottleneck. The certificate size problem: ML-DSA signatures are roughly an order of magnitude larger than ECDSA. Cascade effects: chain validation, OCSP response sizes, TLS handshake latency, and storage. Assessing your PKI’s readiness for post-quantum certificates.
Module 2 Dual-Capability PKI Design
Designing PKI that supports both classical and post-quantum certificates during transition. Dual-certificate hierarchies. Cross-signing strategies. Composite and hybrid certificate approaches. Managing two trust hierarchies in parallel.
Module 3 HSM and Trust Anchor Migration
HSM inventory and PQC support assessment. Firmware upgrade paths and vendor timelines. Trust anchor migration strategies. Root and intermediate CA migration sequencing. Key ceremony considerations for post-quantum roots.
Module 4 Certificate Lifecycle During Transition
Certificate lifecycle management with dual algorithms. Issuance, renewal, and revocation during transition. Automating certificate management for the migration. Monitoring and inventory for a mixed classical/post-quantum certificate estate.
Module 5 Protocol and Application Impact
How PKI changes affect TLS, code signing, S/MIME, and document signing. Application compatibility with larger certificates. Performance testing for PKI-dependent systems. Managing the transition for systems that cannot handle larger certificates.
Module 6 Migration Planning and Execution
Building a PKI migration plan. Sequencing PKI migration relative to the broader cryptographic migration. Testing and validation for PKI changes. Rollback planning. Coordinating PKI migration across the organization and with external partners.
Prerequisites
A working understanding of PQC fundamentals is recommended. Consider Post-Quantum Foundation or PQCS certification for background.
Certificate of Completion
Upon completion, you receive a Quantum Academy certificate of completion. It is separate from our professional certifications and states your CPE credits, one for each 60 minutes of teaching. CISSP, CCSP, CISM and CompTIA SecurityX holders can claim them with their certifying body. The credits also count toward renewing a Quantum Academy certification. Our CPE credits page explains how to claim them.
Who this course is for
PKI architects and operators, certificate lifecycle management owners, and the identity and infrastructure teams who will run the migration. The course covers both enterprise internal PKI and public trust operations.
If you do not own certificate infrastructure, this course goes deeper into it than you will need.
What you’ll be able to do afterward
- Design dual-capability PKI for the PQC transition period
- Assess certificate chain-size consequences of post-quantum signatures
- Plan HSM inventory assessment and firmware upgrade paths
- Design trust anchor migration strategy (long-lived anchors first)
- Manage certificate lifecycle during dual-stack operation
- Evaluate ACME protocol and automated certificate management for PQC
What you leave with
When you finish, we email you the course handbook, a PDF of every slide with notes that explain it in full. We also include a PDF copy of Quantum Ready. The handbook is yours to keep.
Enrollment includes 180 days of access to the online on-demand course. Where that course is not yet published, the 180 days start on the day it is.
Where this course fits
Post-Quantum Foundation or PQCS Specialist Training provides the background for this course. You can take this course without either. PQC Migration: Executing the Waves covers the wider migration program that PKI work is part of, and PQCA Architect Training leads to the credential.
Why we teach this
The course is built on the Applied Quantum PQC Migration Framework. Its author, Marin Ivezic, is one of the practitioners who teach here. The framework is published openly under Creative Commons at pqcframework.org. The people who teach this course run migration programs inside organizations today. The course covers the problems they meet in that work.
About this program
Quantum Academy credentials are private professional credentials issued by Quantum Academy, a trade name of Post-Quantum Institute. They are not government-issued licenses, accredited degrees, or academic credit, and earning one does not guarantee employment, promotion, regulatory approval, or any other specific outcome.
Quantum Academy programs are educational and informational only, and are not legal, compliance, or engineering advice.
